deploy: ad1469c19b

reference-guides/rancher-webhook.html

@@ -8,23 +8,26 @@
 <script>!function(e,t,a,n,g){e[n]=e[n]||[],e[n].push({"gtm.start":(new Date).getTime(),event:"gtm.js"});var m=t.getElementsByTagName(a)[0],r=t.createElement(a);r.async=!0,r.src="https://www.googletagmanager.com/gtm.js?id=GTM-57KS2MW",m.parentNode.insertBefore(r,m)}(window,document,"script","dataLayer")</script>
 
 
+
 <link rel="search" type="application/opensearchdescription+xml" title="Rancher" href="/opensearch.xml">
 
+
 <script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js" charset="UTF-8" data-domain-script="0f98beb0-fc4c-417d-a42e-564e2cae42d2" async></script>
-<script src="/scripts/optanonwrapper.js" async></script><link rel="stylesheet" href="/assets/css/styles.efd70281.css">
-<link rel="preload" href="/assets/js/runtime~main.c3530e4a.js" as="script">
-<link rel="preload" href="/assets/js/main.ef76c68c.js" as="script">
+<script src="/scripts/optanonwrapper.js" async></script><link rel="stylesheet" href="/assets/css/styles.8b4f18d5.css">
+<link rel="preload" href="/assets/js/runtime~main.035a43d4.js" as="script">
+<link rel="preload" href="/assets/js/main.db61f951.js" as="script">
 </head>
 <body class="navigation-with-keyboard">
 <noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-57KS2MW" height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
 
+
 <script>!function(){function t(t){document.documentElement.setAttribute("data-theme",t)}var e=function(){var t=null;try{t=localStorage.getItem("theme")}catch(t){}return t}();t(null!==e?e:"light")}()</script><div id="__docusaurus">
 <div role="region" aria-label="Skip to main content"><a class="skipToContent_fXgn" href="#docusaurus_skipToContent_fallback">Skip to main content</a></div><nav aria-label="Main" class="navbar navbar--fixed-top"><div class="navbar__inner"><div class="navbar__items"><button aria-label="Toggle navigation bar" aria-expanded="false" class="navbar__toggle clean-btn" type="button"><svg width="30" height="30" viewBox="0 0 30 30" aria-hidden="true"><path stroke="currentColor" stroke-linecap="round" stroke-miterlimit="10" stroke-width="2" d="M4 7h22M4 15h22M4 23h22"></path></svg></button><a class="navbar__brand" href="/"><div class="navbar__logo"><img src="/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--light_HNdA"><img src="/img/rancher-logo-horiz-color.svg" alt="logo" class="themedImage_ToTc themedImage--dark_i4oU"></div><b class="navbar__title text--truncate"></b></a><div class="navbar__item dropdown dropdown--hoverable"><a aria-current="page" class="navbar__link active" aria-haspopup="true" aria-expanded="false" role="button" href="/">Latest</a><ul class="dropdown__menu"><li><a aria-current="page" class="dropdown__link dropdown__link--active" href="/reference-guides/rancher-webhook">Latest</a></li><li><a class="dropdown__link" href="/v2.8/reference-guides/rancher-webhook">v2.8 (Preview)</a></li><li><a class="dropdown__link" href="/v2.7/reference-guides/rancher-webhook">v2.7</a></li><li><a class="dropdown__link" href="/v2.6">v2.6</a></li><li><a class="dropdown__link" href="/v2.5">v2.5</a></li><li><a class="dropdown__link" href="/v2.0-v2.4">v2.0-v2.4</a></li><li><a class="dropdown__link" href="/versions">All versions</a></li></ul></div></div><div class="navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a href="#" aria-haspopup="true" aria-expanded="false" role="button" class="navbar__link"><svg viewBox="0 0 24 24" width="20" height="20" aria-hidden="true" class="iconLanguage_nlXk"><path fill="currentColor" d="M12.87 15.07l-2.54-2.51.03-.03c1.74-1.94 2.98-4.17 3.71-6.53H17V4h-7V2H8v2H1v1.99h11.17C11.5 7.92 10.44 9.75 9 11.35 8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5 3.11 3.11.76-2.04zM18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2l-4.5-12zm-2.62 7l1.62-4.33L19.12 17h-3.24z"></path></svg>English</a><ul class="dropdown__menu"><li><a href="/reference-guides/rancher-webhook" target="_self" rel="noopener noreferrer" class="dropdown__link dropdown__link--active" lang="en">English</a></li><li><a href="/zh/reference-guides/rancher-webhook" target="_self" rel="noopener noreferrer" class="dropdown__link" lang="zh">简体中文</a></li></ul></div><a href="https://github.com/rancher/rancher-docs" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link navbar__github">GitHub<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><a href="https://www.rancher.com" target="_blank" rel="noopener noreferrer" class="navbar__item navbar__link">Rancher Home<svg width="13.5" height="13.5" aria-hidden="true" viewBox="0 0 24 24" class="iconExternalLink_nPIU"><path fill="currentColor" d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"></path></svg></a><div class="searchBox_ZlJk"><button type="button" class="DocSearch DocSearch-Button" aria-label="Search"><span class="DocSearch-Button-Container"><svg width="20" height="20" class="DocSearch-Search-Icon" viewBox="0 0 20 20"><path d="M14.386 14.386l4.0877 4.0877-4.0877-4.0877c-2.9418 2.9419-7.7115 2.9419-10.6533 0-2.9419-2.9418-2.9419-7.7115 0-10.6533 2.9418-2.9419 7.7115-2.9419 10.6533 0 2.9419 2.9418 2.9419 7.7115 0 10.6533z" stroke="currentColor" fill="none" fill-rule="evenodd" stroke-linecap="round" stroke-linejoin="round"></path></svg><span class="DocSearch-Button-Placeholder">Search</span></span><span class="DocSearch-Button-Keys"></span></button></div></div></div><div role="presentation" class="navbar-sidebar__backdrop"></div></nav><div id="docusaurus_skipToContent_fallback" class="main-wrapper mainWrapper_z2l0 docsWrapper_BCFX"><button aria-label="Scroll back to top" class="clean-btn theme-back-to-top-button backToTopButton_sjWU" type="button"></button><div class="docPage__5DB"><aside class="theme-doc-sidebar-container docSidebarContainer_b6E3"><div class="sidebarViewport_Xe31"><div class="sidebar_njMd"><nav aria-label="Docs sidebar" class="menu thin-scrollbar menu_SIkG"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-1 menu__list-item"><a class="menu__link" href="/">What is Rancher?</a></li><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"Line truncated
 Rancher deploys Rancher-Webhook as a separate deployment and service in both local and downstream clusters. Rancher manages Rancher-Webhook using Helm. It&#x27;s important to note that Rancher may override modifications made by users to the Helm release.</p><p>Each Rancher version is designed to be compatible with a single version of the webhook. The compatible versions are provided below for convenience.</p><p><strong>Note:</strong> Rancher manages deployment and upgrade of the webhook. Under most circumstances, no user intervention should be needed to ensure that the webhook version is compatible with the version of Rancher that you are running.</p><table><thead><tr><th>Rancher Version</th><th align="center">Webhook Version</th></tr></thead><tbody><tr><td>v2.7.0</td><td align="center">v0.3.0</td></tr><tr><td>v2.7.1</td><td align="center">v0.3.0</td></tr><tr><td>v2.7.2</td><td align="center">v0.3.2</td></tr><tr><td>v2.7.3</td><td align="center">v0.3.3</td></tr><tr><td>v2.7.4</td><td align="center">v0.3.4</td></tr><tr><td>v2.7.5</td><td align="center">v0.3.5</td></tr><tr><td>v2.7.6</td><td align="center">v0.3.5</td></tr></tbody></table><h2 class="anchor anchorWithStickyNavbar_LWe7" id="why-do-we-need-it">Why Do We Need It?<a href="#why-do-we-need-it" class="hash-link" aria-label="Direct link to Why Do We Need It?" title="Direct link to Why Do We Need It?">​</a></h2><p>Rancher-Webhook is crucial for Rancher to protect clusters against malicious attacks and enable various features.
 Rancher relies on the Rancher-Webhook as an integral part of its functionality. Without the webhook, Rancher would not be a complete product.
 It provides essential protection for Rancher-managed clusters, preventing security vulnerabilities and ensuring the consistency and stability of the cluster.</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="what-resources-does-the-webhook-validate">What Resources Does the Webhook Validate?<a href="#what-resources-does-the-webhook-validate" class="hash-link" aria-label="Direct link to What Resources Does the Webhook Validate?" title="Direct link to What Resources Does the Webhook Validate?">​</a></h2><p>An in-progress list of the resources that the webhook validates can be found in the <a href="https://github.com/rancher/webhook/blob/release/v0.4/docs.md" target="_blank" rel="noopener noreferrer">webhook&#x27;s repo</a>. Checks specific to one version can be found by viewing the <code>docs.md</code> file associated with a particular tag (note that webhook versions prior to <code>v0.3.6</code> won&#x27;t have this file).</p><h2 class="anchor anchorWithStickyNavbar_LWe7" id="bypassing-the-webhook">Bypassing the Webhook<a href="#bypassing-the-webhook" class="hash-link" aria-label="Direct link to Bypassing the Webhook" title="Direct link to Bypassing the Webhook">​</a></h2><p>Sometimes, it may be necessary to bypass Rancher&#x27;s webhook validation to perform emergency restore operations, or fix other critical issues. The bypass operation is exhaustive, meaning that no webhook checks will apply when this is used. It is not possible to bypass some checks and have others still apply - they are either all bypassed, or all active. </p><div class="theme-admonition theme-admonition-danger alert alert--danger admonition_LlT9"><div class="admonitionHeading_tbUL"><span class="admonitionIcon_kALy"><svg viewBox="0 0 12 16"><path fill-rule="evenodd" d="M5.05.31c.81 2.17.41 3.38-.52 4.31C3.55 5.67 1.98 6.45.9 7.98c-1.45 2.05-1.7 6.53 3.53 7.7-2.2-1.16-2.67-4.52-.3-6.61-.61 2.03.53 3.33 1.94 2.86 1.39-.47 2.3.53 2.27 1.67-.02.78-.31 1.44-1.13 1.81 3.42-.59 4.78-3.42 4.78-5.56 0-2.84-2.53-3.22-1.25-5.61-1.52.13-2.03 1.13-1.89 2.75.09 1.08-1.02 1.8-1.86 1.33-.67-.41-.66-1.19-.06-1.78C8.18 5.31 8.68 2.45 5.05.32L5.03.3l.02.01z"></path></svg></span>danger</div><div class="admonitionContent_S0QG"><p>Rancher&#x27;s webhook provides critical security protections. Bypassing the webhook should only be done by administrators in specific scenarios, after all other options have been exhausted. In addition, permission to bypass the webhook should be carefully controlled, and never given to users who are not admins.</p></div></div><p>To bypass the webhook, impersonate both the <code>rancher-webhook-sudo</code> service account and the <code>system:masters</code> group (both are required):</p><div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">kubectl create -f example.yaml --as</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">system:serviceaccount:cattle-system:rancher-webhook-sudo --as-group</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">system:masters</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><h2 class="anchor anchorWithStickyNavbar_LWe7" id="common-issues">Common Issues<a href="#common-issues" class="hash-link" aria-label="Direct link to Common Issues" title="Direct link to Common Issues">​</a></h2><h3 class="anchor anchorWithStickyNavbar_LWe7" id="eks-cluster-with-calico-cni">EKS Cluster with Calico CNI<a href="#eks-cluster-with-calico-cni" class="hash-link" aria-label="Direct link to EKS Cluster with Calico CNI" title="Direct link to EKS Cluster with Calico CNI">​</a></h3><p>Users running an EKS cluster with Calico CNI may run into errors when the Kubernetes API server attempts to contact the Rancher-Webhook.
 One workaround for this issue <a href="https://docs.tigera.io/calico/latest/getting-started/kubernetes/managed-public-cloud/eks#install-eks-with-calico-networking" target="_blank" rel="noopener noreferrer">documented by Calico</a> involves setting <code>hostNetwork=true</code> for the webhook deployment. Users can change this using the Helm commands below on the affected clusters.</p><div class="language-bash codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-bash codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">helm repo </span><span class="token function" style="color:rgb(130, 170, 255)">add</span><span class="token plain"> rancher-charts https://charts.rancher.io </span><br></span><span class="token-line" style="color:#bfc7d5"><span class="token plain">helm upgrade --reuse-values rancher-webhook rancher-chart/rancher-webhook  -n cattle-system --set global.hostNetwork</span><span class="token operator" style="color:rgb(137, 221, 255)">=</span><span class="token plain">true</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p><strong>Note:</strong> This temporary workaround may violate an environment&#x27;s security policy. This workaround also requires that port 9443 is unused on the host network.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="private-gke-cluster">Private GKE Cluster<a href="#private-gke-cluster" class="hash-link" aria-label="Direct link to Private GKE Cluster" title="Direct link to Private GKE Cluster">​</a></h3><p>When using a private GKE cluster, errors may occur that prevent the Kubernetes API server from communicating with the webhook. The following error message may appear:</p><div class="codeBlockContainer_Ckt0 theme-code-block" style="--prism-color:#bfc7d5;--prism-background-color:#292d3e"><div class="codeBlockContent_biex"><pre tabindex="0" class="prism-code language-text codeBlock_bY9V thin-scrollbar"><code class="codeBlockLines_e6Vv"><span class="token-line" style="color:#bfc7d5"><span class="token plain">Internal error occurred: failed calling webhook &quot;rancher.cattle.io.namespaces.create-non-kubesystem&quot;: failed to call webhook: Post &quot;https://rancher-webhook.cattle-system.svc:443/v1/webhook/validation/namespaces?timeout=10s&quot;: context deadline exceeded</span><br></span></code></pre><div class="buttonGroup__atx"><button type="button" aria-label="Copy code to clipboard" title="Copy" class="clean-btn"><span class="copyButtonIcons_eSgA" aria-hidden="true"><svg class="copyButtonIcon_y97N" viewBox="0 0 24 24"><path d="M19,21H8V7H19M19,5H8A2,2 0 0,0 6,7V21A2,2 0 0,0 8,23H19A2,2 0 0,0 21,21V7A2,2 0 0,0 19,5M16,1H4A2,2 0 0,0 2,3V17H4V3H16V1Z"></path></svg><svg class="copyButtonSuccessIcon_LjdS" viewBox="0 0 24 24"><path d="M21,7L9,19L3.5,13.5L4.91,12.09L9,16.17L19.59,5.59L21,7Z"></path></svg></span></button></div></div></div><p>This issue occurs because firewall rules restrict communication between the API server and the private cluster. To resolve this communication problem, users must add firewall rules to allow the GKE control plane to communicate with the Rancher-Webhook on port 9443. Please refer to the <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters#add_firewall_rules" target="_blank" rel="noopener noreferrer">GKE documentation</a> for detailed information and steps on updating the firewall rules.</p><h3 class="anchor anchorWithStickyNavbar_LWe7" id="application-fails-to-deploy-due-to-rancher-webhook-blocking-access">Application Fails to Deploy Due to rancher-webhook Blocking Access<a href="#application-fails-to-deploy-due-to-rancher-webhook-blocking-access" class="hash-link" aria-label="Direct link to Application Fails to Deploy Due to rancher-webhook Blocking Access" title="Direct link to Application Fails to Deploy Due to rancher-webhook Blocking Access">​</a></h3><p>The webhook provides extra validations on <a href="https://github.com/rancher/webhook/blob/release/v0.4/docs.md#psa-label-validation" target="_blank" rel="noopener noreferrer">namespaces</a>. One of these validations ensures that users can only update PSA relevant labels if they have the proper permissions (<code>updatepsa</code> for <code>projects</code> in <code>management.cattle.io</code>). This can result in specifLine truncated
-<script src="/assets/js/runtime~main.c3530e4a.js"></script>
-<script src="/assets/js/main.ef76c68c.js"></script>
+<script src="/assets/js/runtime~main.035a43d4.js"></script>
+<script src="/assets/js/main.db61f951.js"></script>
 </body>
 </html>